How secure is this IPTABLES setup?

jimbo7 · 07-13-2007, 10:54 PM

I'm a bit of a newb and this is my first go at creating an iptables / nat script. however I'm not sure if this is secure enough...
i really want to make my config as secure as possible, so any suggestions/comments are greatly appreciated

notes:

the script is run on my gateway machine
eth0 is my local (hopefully secure) network
wlan0 is my connection to the internet

Code:

#!/bin/sh
#
# Created by James Sullivan
# Last updated 13/07/07
#
#


PATH=/usr/sbin:/sbin:/bin:/usr/bin

# temporarily block all traffic.
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Delete/Flush old iptables rules
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Set default policies
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Prevent external packets from using loopback addr [OPTIONAL]
iptables -A INPUT   -i wlan0 -s 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -s 127.0.0.1 -j DROP
iptables -A INPUT   -i wlan0 -d 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -d 127.0.0.1 -j DROP

# Anything coming from/going to Internet should not
# use private addresses [OPTIONAL]
iptables -A FORWARD -i wlan0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i wlan0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i wlan0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i wlan0 -s 10.0.0.0/8 -j DROP

# Block outgoing NetBios [OPTIONAL]
iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP

# Allow local loopback [NEEDED]
iptables -A INPUT -i lo -j ACCEPT

# Allow pings [OPTIONAL]
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT


############ STATE STUFF ############
# Accept existing connections [NEEDED]
iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow any new conections from internal network
# [ONLY NEEDED IF PORTS ARE NOT EXPLITLY FORWARDED BELOW]
#iptables -A INPUT -m state --state NEW -i eth0 -j ACCEPT
#####################################

# Allow inbound services [OPTIONAL - DNS NEEDED]
iptables -A INPUT -p tcp -i wlan0 --dport 44444 -j ACCEPT #SSH
iptables -A INPUT -p tcp -i wlan0 --dport 23232 -j ACCEPT #Bittorrent
iptables -A INPUT -p udp -i wlan0 --dport 23232 -j ACCEPT #Bittorrent
iptables -A INPUT -p udp -i eth0  --dport 53 -j ACCEPT #DNS cache
iptables -A INPUT -p tcp -i eth0  --dport 53 -j ACCEPT #DNS cache
iptables -A INPUT -p udp -i eth0  --dport 137:139 -j ACCEPT #SAMBA
iptables -A INPUT -p tcp -i eth0  --dport 445 -j ACCEPT #SAMBA


# Allow forwarding of essential services [NEEDED]
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT #WEB
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT #HTTPS

# Don't forward from the outside to the inside [OPTIONAL]
iptables -A FORWARD -i wlan0 -o eth0 -j REJECT


# Masquerade [NEEDED]
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Simon Bridge · 07-14-2007, 01:24 AM

That's pretty secure and unusually clear for a first time firewall.

You are offering a few services... be aware of the vulnerabilities of these services. This is where you will be attacked.

Note, you can use samba tools to further secure... samba.
http://troy.jdmz.net/samba/fw/

win32sux · 07-14-2007, 04:33 AM

Here's a few things I would recommend to tighten it a bit:

Quote:

Originally Posted by jimbo7

iptables -A FORWARD -p tcp --dport 80 -j ACCEPT #WEB
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT #HTTPS

Make these more specific, with interface names and packet states. Like:

Code:

iptables -A FORWARD -p tcp -i eth0 -o wlan0 --dport 80 \
-m state --state NEW -j ACCEPT

iptables -A FORWARD -p tcp -i eth0 -o wlan0 --dport 443 \
-m state --state NEW -j ACCEPT

Quote:

Originally Posted by jimbo7

# Don't forward from the outside to the inside [OPTIONAL]
iptables -A FORWARD -i wlan0 -o eth0 -j REJECT

Eliminate this rule.

You are much better-off letting the packets hit the DROP policy.

Quote:

Originally Posted by jimbo7

echo 1 > /proc/sys/net/ipv4/ip_forward

Add a line like this to the start of the script, but have it echo a zero instead of a one. This way, you know that any time the script is run, forwarding will be disabled until everything is set-up.

Quote:

Originally Posted by jimbo7

iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP

Sending OUTPUT packets to DROP without sending them to LOG first is a habit that should be avoided as much as possible. Generally speaking, it's important to know exactly when unusual packets are being generated by your box. It can sometimes mean the difference between (for example) knowing your Apache's been owned, and being clueless about it.

Code:

iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j LOG \
--log-prefix "OUTPUT DROP: "
iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP

iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j LOG \
--log-prefix "OUTPUT DROP: "
iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP

jimbo7 · 07-16-2007, 02:24 AM

Thanks for your help guys.

I have made the suggested changes, and fixed a couple of things i got wrong (mixed up eth0 and wlan0 in my netbios blocks)

here is the latest version

:

Code:

#!/bin/sh
#
# Created by James Sullivan
# Last updated 16/07/07
#
#


PATH=/usr/sbin:/sbin:/bin:/usr/bin

# temporarily disable routing
echo 0 > /proc/sys/net/ipv4/ip_forward

# temporarily block all traffic
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Delete/Flush old iptables rules
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Set default policies
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Prevent external packets from using loopback addresses [OPTIONAL]
iptables -A INPUT   -i wlan0 -s 127.0.0.1 -j DROP
iptables -A INPUT   -i wlan0 -d 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -s 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -d 127.0.0.1 -j DROP

# Anything coming from/going to Internet should not
# use private addresses [OPTIONAL]
iptables -A INPUT   -i wlan0 -s 172.16.0.0/12  -j DROP
iptables -A INPUT   -i wlan0 -s 10.0.0.0/8     -j DROP
iptables -A INPUT   -i wlan0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i wlan0 -s 172.16.0.0/12  -j DROP
iptables -A FORWARD -i wlan0 -s 10.0.0.0/8     -j DROP
iptables -A FORWARD -i wlan0 -s 192.168.0.0/24 -j DROP

# Block outgoing NetBios [OPTIONAL]
iptables -A FORWARD -p tcp --sport 137:139 -o wlan0 -j LOG --log-prefix "FORWARD DROP: "
iptables -A FORWARD -p tcp --sport 137:139 -o wlan0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o wlan0 -j LOG --log-prefix "FORWARD DROP: "
iptables -A FORWARD -p udp --sport 137:139 -o wlan0 -j DROP
iptables -A OUTPUT  -p tcp --sport 137:139 -o wlan0 -j LOG --log-prefix "OUTPUT DROP: "
iptables -A OUTPUT  -p tcp --sport 137:139 -o wlan0 -j DROP
iptables -A OUTPUT  -p udp --sport 137:139 -o wlan0 -j LOG --log-prefix "OUTPUT DROP: "
iptables -A OUTPUT  -p udp --sport 137:139 -o wlan0 -j DROP

# Allow local loopback [NEEDED]
iptables -A INPUT -i lo -j ACCEPT

# Allow pings [OPTIONAL]
iptables -A INPUT   -p icmp --icmp-type echo-request -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT


############ STATE STUFF ############
# Accept existing connections [NEEDED]
iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow any new conections from internal network
# [ONLY NEEDED IF PORTS ARE NOT EXPLITLY FORWARDED BELOW]
#iptables -A INPUT -m state --state NEW -i eth0 -j ACCEPT
#####################################

# Externally accessable inbound services [OPTIONAL]
iptables -A INPUT -p tcp --dport 44444 -m state --state NEW -j ACCEPT #SSH
iptables -A INPUT -p tcp -i wlan0 --dport 23232 -m state --state NEW -j ACCEPT #Bittorrent
iptables -A INPUT -p udp -i wlan0 --dport 23232 -m state --state NEW -j ACCEPT #Bittorrent

# Internal inbound services [OPTIONAL - DNS NEEDED]
iptables -A INPUT -p udp -i eth0 --dport 53      -m state --state NEW -j ACCEPT #DNS cache
iptables -A INPUT -p tcp -i eth0 --dport 53      -m state --state NEW -j ACCEPT #DNS cache
iptables -A INPUT -p udp -i eth0 --dport 137:139 -m state --state NEW -j ACCEPT #SAMBA
iptables -A INPUT -p tcp -i eth0 --dport 445     -m state --state NEW -j ACCEPT #SAMBA

# Allow forwarding of essential services [NEEDED]
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT #WEB
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT #HTTPS

# Masquerade [NEEDED]
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

win32sux · 07-16-2007, 01:59 PM

Looks good. Although, you're still forwarding port 80 and 443 packets regardless of the interface they hit or what state they have. I haven't run a test, but I would suspect this opens you up to certain types of mischief at the very least. Better safe than sorry, no?

jimbo7 · 07-19-2007, 08:32 AM

whoops forgot those ones, updated:

Code:

#!/bin/sh
#
# Created by James Sullivan
# Last updated 16/07/07
#
# wlan0 > interface connected to internet (via router / etc)
# eth0  > interface connected to local protected network


PATH=/usr/sbin:/sbin:/bin:/usr/bin

# temporarily disable routing and block all traffic
echo 0 > /proc/sys/net/ipv4/ip_forward
iptables -P OUTPUT  DROP
iptables -P INPUT   DROP
iptables -P FORWARD DROP

# Delete/Flush old iptables rules
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Set default policies
iptables -P OUTPUT  ACCEPT
iptables -P INPUT   DROP
iptables -P FORWARD DROP

# Prevent external packets from using loopback addresses [OPTIONAL]
iptables -A INPUT   -i wlan0 -s 127.0.0.1 -j DROP
iptables -A INPUT   -i wlan0 -d 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -s 127.0.0.1 -j DROP
iptables -A FORWARD -i wlan0 -d 127.0.0.1 -j DROP

# Anything coming from/going to Internet should not
# use private addresses [OPTIONAL]
iptables -A INPUT   -i wlan0 -s 172.16.0.0/12  -j DROP
iptables -A INPUT   -i wlan0 -s 10.0.0.0/8     -j DROP
iptables -A INPUT   -i wlan0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i wlan0 -s 172.16.0.0/12  -j DROP
iptables -A FORWARD -i wlan0 -s 10.0.0.0/8     -j DROP
iptables -A FORWARD -i wlan0 -s 192.168.0.0/24 -j DROP

# Block outgoing NetBios [OPTIONAL]
iptables -A FORWARD -p tcp --sport 137:139 -o wlan0 -j LOG --log-prefix "FORWARD DROP: "
iptables -A FORWARD -p tcp --sport 137:139 -o wlan0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o wlan0 -j LOG --log-prefix "FORWARD DROP: "
iptables -A FORWARD -p udp --sport 137:139 -o wlan0 -j DROP
iptables -A OUTPUT  -p tcp --sport 137:139 -o wlan0 -j LOG --log-prefix "OUTPUT DROP: "
iptables -A OUTPUT  -p tcp --sport 137:139 -o wlan0 -j DROP
iptables -A OUTPUT  -p udp --sport 137:139 -o wlan0 -j LOG --log-prefix "OUTPUT DROP: "
iptables -A OUTPUT  -p udp --sport 137:139 -o wlan0 -j DROP

# Allow local loopback [NEEDED]
iptables -A INPUT -i lo -j ACCEPT

# Allow pings [OPTIONAL]
iptables -A INPUT   -p icmp --icmp-type echo-request -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT


############ STATE STUFF ############
# Accept existing connections [NEEDED]
iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow any new conections from internal network
# [ONLY NEEDED IF PORTS ARE NOT EXPLITLY FORWARDED BELOW]
#iptables -A INPUT -m state --state NEW -i eth0 -j ACCEPT
#####################################

# Externally accessable inbound services [OPTIONAL]
iptables -A INPUT -p tcp --dport 44444 -m state --state NEW -j ACCEPT #SSH
iptables -A INPUT -p tcp -i wlan0 --dport 23232 -m state --state NEW -j ACCEPT #Bittorrent
iptables -A INPUT -p udp -i wlan0 --dport 23232 -m state --state NEW -j ACCEPT #Bittorrent

# Internal inbound services [OPTIONAL - DNS NEEDED]
iptables -A INPUT -p udp -i eth0 --dport 53      -m state --state NEW -j ACCEPT #DNS cache
iptables -A INPUT -p tcp -i eth0 --dport 53      -m state --state NEW -j ACCEPT #DNS cache
iptables -A INPUT -p udp -i eth0 --dport 137:139 -m state --state NEW -j ACCEPT #SAMBA
iptables -A INPUT -p tcp -i eth0 --dport 445     -m state --state NEW -j ACCEPT #SAMBA

# Allow forwarding of essential services [NEEDED]
iptables -A FORWARD -p tcp -i eth0 -o wlan0  -m state --state NEW --dport 80  -j ACCEPT #WEB
iptables -A FORWARD -p tcp -i eth0 -o wlan0  -m state --state NEW --dport 443 -j ACCEPT #HTTPS

# Masquerade [NEEDED]
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward